Self-hosted SOCKS5 proxy storefront. Sells access to residential/mobile/datacenter proxies. Bitcoin via BTCPay. No KYC — username + email + password + arithmetic captcha.

Stack

App: Flask single-page app, /opt/rigel/app.py (SQLite, no-KYC auth)
CT: 158 rigel @ 10.30.20.116, Debian 12, nginx :80 → Flask :5000
Service: rigel.service (systemd)
Payments: BTCPay store [redacted] / key [redacted] (webhook → /api/btcpay/webhook)
Public: https://rigel.thetempleofdoom.com (fleet tunnel 1aeb1ac0, REMOTE-MANAGED config via CF API)

Inventory

Location	Type	Endpoint
Tokyo	datacenter (Nord exit)	CT680 `10.30.20.154:1080`
London	datacenter (Nord exit)	CT681 `10.30.20.71:1080`
Sydney	datacenter (Nord exit)	CT682 `10.30.20.189:1080`
Residential	rotating/sticky	IPRoyal `geo.iproyal.com:12321`
Mobile 4G	rotating	IPRoyal `4g.iproyal.com`

API

POST /api/register — {username, email, password, captcha_id, captcha}
POST /api/login — {username, password}
GET /api/captcha — arithmetic challenge
POST /api/buy — {plan_id} → creates BTCPay invoice + pending subscription
GET /api/subscriptions — user's active proxies
POST /api/btcpay/webhook — activates subscription + issues creds on payment

Deploy

tar czf rigel.tar.gz app.py
scp rigel.tar.gz root@10.30.20.85:/tmp/
ssh root@10.30.20.85 "pct push 158 /tmp/rigel.tar.gz /tmp/rigel.tar.gz && pct exec 158 -- bash -c 'cd /opt/rigel && tar xzf /tmp/rigel.tar.gz && systemctl restart rigel'"

Gotchas

Fleet tunnel is REMOTE-MANAGED — edit ingress via CF API (/accounts/<id>/cfd_tunnel/1aeb1ac0.../configurations), NOT the local config-fleet.yml. Local edits are ignored.
BTCPay webhook secret wired via BTCPAY_WEBHOOK_SECRET env in rigel.service.